critical9.0Public exploit code
CVE-2024-6516
Cross Site Scripting vulnerabilities where found providing a potential for malicious scripts to be injected into a client browser.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- ABB Cylon Aspect 3.08.02 (bbmdUpdate.php) - Remote Code Execution2025-04-15 · hardware · multiple
- ABB Cylon Aspect 3.08.02 (licenseUpload.php) - Stored Cross-Site Scripting2025-04-15 · hardware · multiple
- ABB Cylon Aspect 3.08.02 (licenseServerUpdate.php) - Stored Cross-Site Scripting2025-04-15 · hardware · multiple
Impact
Cross Site Scripting vulnerabilities where found providing a potential for malicious scripts to be injected into a client browser. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Abb | Aspect-Ent-2 Firmware | before 3.08.03 |
| Abb | Aspect-Ent-256 Firmware | before 3.08.03 |
| Abb | Aspect-Ent-96 Firmware | before 3.08.03 |
| Abb | Nexus-2128 Firmware | before 3.08.03 |
| Abb | Nexus-2128-A Firmware | before 3.08.03 |
| Abb | Nexus-2128-F Firmware | before 3.08.03 |
| Abb | Nexus-2128-G Firmware | before 3.08.03 |
| Abb | Nexus-264 Firmware | before 3.08.03 |
| Abb | Nexus-264-A Firmware | before 3.08.03 |
| Abb | Nexus-264-G Firmware | before 3.08.03 |
| Abb | Nexus-3-2128 Firmware | before 3.08.03 |
| Abb | Aspect-Ent-12 Firmware | before 3.08.03 |